@sealant/sdk 0.11.0 → 0.12.1

package/dist/internal/blueprint.js

@@ -14,6 +14,7 @@ import { randomUUID } from "node:crypto";
 import { SealantError } from "../errors.js";
 import { mapWorkspaceCredentials } from "./credentials.js";
 import { parseTtlSeconds } from "./duration.js";
+import { discoverLinkedWorktreeMetadataMount } from "./linked-worktree.js";
 const sanitizeRepoSlug = (value) => {
     const slug = value
         .toLowerCase()
@@ -43,6 +44,23 @@ export const buildCreateWorkspaceRequest = (options, config) => {
         .filter((s) => s.length > 0)
         .pop() ?? sourceName;
     const credentials = mapWorkspaceCredentials(options.credentials);
+    const linkedWorktreeMount = options.source === undefined ? null : discoverLinkedWorktreeMetadataMount(options.source.path);
+    const explicitMounts = options.mounts ?? [];
+    const existingMetadataMount = linkedWorktreeMount === null
+        ? undefined
+        : explicitMounts.find((mount) => mount.mountPath === linkedWorktreeMount.mountPath);
+    if (linkedWorktreeMount !== null &&
+        existingMetadataMount !== undefined &&
+        (existingMetadataMount.hostPath !== linkedWorktreeMount.hostPath ||
+            existingMetadataMount.readOnly !== false)) {
+        throw new SealantError(`Mount path ${linkedWorktreeMount.mountPath} is required for writable linked-worktree Git metadata and conflicts with an explicit mount.`, { code: "linked_worktree_mount_conflict" });
+    }
+    const mounts = [
+        ...explicitMounts,
+        ...(linkedWorktreeMount === null || existingMetadataMount !== undefined
+            ? []
+            : [linkedWorktreeMount]),
+    ];
     const spec = {
         version: "1",
         sources: {
@@ -55,10 +73,10 @@ export const buildCreateWorkspaceRequest = (options, config) => {
                     ...(options.ref === undefined ? {} : { ref: options.ref }),
                 }
                 : { kind: "mount", hostPath: options.source?.path },
-            ...(options.mounts === undefined || options.mounts.length === 0
+            ...(mounts.length === 0
                 ? {}
                 : {
-                    mounts: options.mounts.map((mount) => ({
+                    mounts: mounts.map((mount) => ({
                         hostPath: mount.hostPath,
                         mountPath: mount.mountPath,
                         // Omitted = the blueprint's default (read-only). Only an explicit choice is sent.

package/dist/internal/linked-worktree.d.ts

@@ -0,0 +1,12 @@
+export interface LinkedWorktreeMetadataMount {
+    readonly hostPath: string;
+    readonly mountPath: string;
+    readonly readOnly: false;
+}
+/**
+ * A linked Git worktree carries a `.git` POINTER FILE rather than its repository metadata. Docker
+ * mounting only the worktree preserves that file but not the absolute host path it names. Discover
+ * the shared Git directory so the workspace creator can bind it at the same absolute path inside
+ * the container; the pointer then works unchanged and no repository data is copied.
+ */
+export declare const discoverLinkedWorktreeMetadataMount: (sourcePath: string) => LinkedWorktreeMetadataMount | null;

package/dist/internal/linked-worktree.js

@@ -0,0 +1,74 @@
+import { readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { SealantError } from "../errors.js";
+const isMissingPath = (cause) => typeof cause === "object" &&
+    cause !== null &&
+    "code" in cause &&
+    (cause.code === "ENOENT" || cause.code === "ENOTDIR");
+const readIfPresent = (file) => {
+    try {
+        return readFileSync(file, "utf8");
+    }
+    catch (cause) {
+        if (isMissingPath(cause))
+            return null;
+        throw new SealantError(`Could not inspect mounted workspace Git metadata at ${file}.`, {
+            code: "mount_source_git_inspection_failed",
+            cause,
+        });
+    }
+};
+const requireDirectory = (directory) => {
+    try {
+        if (statSync(directory).isDirectory())
+            return;
+    }
+    catch (cause) {
+        throw new SealantError(`Mounted workspace Git metadata points to an unreadable directory: ${directory}.`, { code: "mount_source_git_metadata_invalid", cause });
+    }
+    throw new SealantError(`Mounted workspace Git metadata points to a non-directory path: ${directory}.`, { code: "mount_source_git_metadata_invalid" });
+};
+const isWithin = (child, parent) => {
+    const fromParent = relative(parent, child);
+    return fromParent === "" || (!fromParent.startsWith("..") && !isAbsolute(fromParent));
+};
+/**
+ * A linked Git worktree carries a `.git` POINTER FILE rather than its repository metadata. Docker
+ * mounting only the worktree preserves that file but not the absolute host path it names. Discover
+ * the shared Git directory so the workspace creator can bind it at the same absolute path inside
+ * the container; the pointer then works unchanged and no repository data is copied.
+ */
+export const discoverLinkedWorktreeMetadataMount = (sourcePath) => {
+    const dotGit = join(sourcePath, ".git");
+    let dotGitStat;
+    try {
+        dotGitStat = statSync(dotGit);
+    }
+    catch (cause) {
+        if (isMissingPath(cause))
+            return null;
+        throw new SealantError(`Could not inspect mounted workspace Git entry at ${dotGit}.`, {
+            code: "mount_source_git_inspection_failed",
+            cause,
+        });
+    }
+    // A normal repository already carries its complete `.git` directory inside the primary mount.
+    if (!dotGitStat.isFile())
+        return null;
+    const pointer = readIfPresent(dotGit);
+    const gitDirValue = pointer?.match(/^gitdir:\s*(.+)\s*$/m)?.[1]?.trim();
+    // A non-Git folder is still a valid mount source. Only Git's documented pointer shape opts in.
+    if (gitDirValue === undefined || gitDirValue === "")
+        return null;
+    const gitDir = resolve(dirname(dotGit), gitDirValue);
+    requireDirectory(gitDir);
+    const commonDirValue = readIfPresent(join(gitDir, "commondir"))?.trim();
+    const metadataRoot = commonDirValue === undefined || commonDirValue === ""
+        ? gitDir
+        : resolve(gitDir, commonDirValue);
+    requireDirectory(metadataRoot);
+    // Unusual but already functional: the pointer resolves within the primary mount itself.
+    if (isWithin(metadataRoot, sourcePath))
+        return null;
+    return { hostPath: metadataRoot, mountPath: metadataRoot, readOnly: false };
+};

package/dist/types.d.ts

@@ -94,6 +94,9 @@ export interface WorkspaceCredentialsOptions {
  * A workspace sourced from a CALLER-OWNED host directory instead of a fresh clone. The platform
  * bind-mounts `path` as the workspace working directory and treats it as caller-owned: writes
  * persist across workspace stop/restart/expiry, and the path is never reprovisioned or deleted.
+ * When `path` is a linked Git worktree, the SDK also binds its shared Git metadata at the absolute
+ * path named by the worktree's `.git` pointer. The metadata remains caller-owned and host-backed;
+ * no repository data is copied into container-owned storage.
  * The install must allowlist the path's root (`SEALANT_MOUNT_ALLOWED_STORE_ROOTS`); paths
  * outside the allowlist are rejected at create. Credentials and dotfiles options compose
  * unchanged. Clone-based workspaces remain the right shape for independent verification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "effect": "^4.0.0-beta.85",
-    "@sealant/api-contracts": "^0.11.0"
+    "@sealant/api-contracts": "^0.12.1"
   },
   "devDependencies": {
     "@effect/vitest": "^4.0.0-beta.85",